The fact that your employer might direct you to a URL that doesn't look like their normal domain (or through some kinda link shortener so you can't see it without clicking) for legitimate reasons basically undoes all security yeah. Why can't security teams focus on correcting those parts?
The normal workflow is so ingrained in our company culture, that I received an email from our IT team about not clicking on embedded links, and that email had a embedded link to "learn more". ;-)
